Someone has to own security
Sooner or later the board, a regulator or an enterprise customer asks who is accountable for security. Hiring a full-time CISO is expensive and slow, and the role is demanding. Our CISO as a Service gives you an accountable, experienced security leader who knows your business, reports to your management and keeps your programme moving, on a predictable monthly retainer.
What your DataFence CISO does
Security strategy
A cybersecurity strategy and roadmap aligned with your business objectives, with objectives you can track.
Risk management
A full risk assessment and security posture review, regular reassessments and risk mitigation plans.
Policies and compliance
Security policies and procedures written and maintained, aligned with ISO 27001, SOC 2 and the regulations that apply to you.
Security operations oversight
Oversight of security operations, security tooling and incident response management.
Incident response leadership
Incident response plans kept current, and leadership and coordination during an incident.
Awareness and training
Security awareness programmes and regular training for employees.
Vendor and third-party risk
Assessment of supplier risk, and follow-through to make sure vendors meet your security requirements.
Security architecture review
Guidance so that new projects and systems are secure by design, with access to an application security expert.
Customer-facing security
Participation in customer security conversations, plus security questionnaires and due-diligence reviews.
Budget and resources
Advice on security budget planning and making efficient use of tools and resources.
Board and executive reporting
Regular reporting on security status and risk, strategic recommendations and a weekly status meeting.
Continuous improvement
Tracking emerging threats and recommending new tools, technologies and processes.
From onboarding to ongoing leadership
- 01
Onboarding
- Kick-off with management
- Stakeholders, scope and access
- Regulatory and contractual requirements
- 02
Assessment
- Risk assessment and security posture review
- Gap analysis against target frameworks
- Critical assets and existing controls
- 03
Roadmap
- A plan prioritised by risk
- Owners, dates and budget guidance
- Policies and procedures to build
- 04
Ongoing CISO
- Weekly status meeting
- Board and executive reporting
- Audits, surveillance and continuous improvement
Why outsource the CISO role
- Lower cost than an in-house CISO, with a predictable monthly fee
- Experience gained across many organisations and industries
- An unbiased, proactive view of your risks
- Quick improvements in the short term, and a solid long-term foundation through training and core infrastructure
- Threats and risks identified before they cause damage
- One person accountable to your management and board
Outcome
Executive-grade security leadership, accountable to your board, at a fraction of the cost of a full-time hire.
Often combined with
- Certification & complianceISO/IEC 27001 certification escortGap analysis to Stage 2 audit and annual surveillance.Learn more
- Certification & complianceSOC 2 Type II readinessFrom scoping to a clean Type II report.Learn more
- Security leadershipDPO / Privacy Officer as a ServicePrivacy leadership aligned with GDPR and the Israeli Privacy Protection Law, including Amendment 13.Learn more
Frequently asked questions
What is a virtual CISO?
A virtual or fractional CISO is an experienced Chief Information Security Officer who leads your security programme part-time on a retainer. They do the same job as an in-house CISO: strategy, risk, policies, oversight and reporting.
How is CISO as a Service priced?
As a monthly retainer with a defined scope and number of monthly hours. You get a tailored offer within 24 hours of our first conversation.
Can the CISO help us get certified?
Yes. ISO 27001 and SOC 2 alignment can be part of the CISO scope. We'll recommend whether a dedicated certification programme makes more sense for your timeline.
Will the CISO talk to our customers?
Yes. Customer security conversations, security questionnaires and due-diligence reviews can be included in the scope.
What commitment is required?
The term, scope and monthly hours are agreed up front and set out in your tailored offer, so there are no surprises.
Ready for your free consultation?
Tell us about your security and compliance goals. Within 24 hours of our first conversation, we'll send you a detailed, cost-effective offer tailored to your needs.